CVE-2025-66434HIGH 8.8EPSS p39.2%
CVE-2025-66434CVE-2025-66434
Description
An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to configure Dunning Type and its child table Dunning Letter Text can inject arbitrary Jinja expressions, resulting in server-side code execution within a restricted but still unsafe context. This can leak database information.
Scoring
| CVSS 3.1 | 8.8 (HIGH) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 0.51% probability of exploitation · percentile 39.2% · 2026-06-19T12:03:05Z |
| Published | 2025-12-15 |
| Last modified | 2025-12-23 |
Underlying weaknesses· 2
References
2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Neutralization of Special Elements Used in a Template Enginecwe-1336 | 0% | live |
| Weakness | Improper Control of Generation of Code ('Code Injection')cwe-94 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.